Alcatel Pop35 Notes

Stock kernel output

Here is dmesg collected with TCLFeedback util http://pastebin.com/yWe0CRCi

---

Vendor kernel source

Alcatel released GPL sources for device https://sourceforge.net/projects/alcatel/files/?source=navbar
Filename OT_5065_20160506.tar.xz

---

Parse vendor kernel source for device traces

Vendor sources contain configs for alot of devices.
Quick grep sources to find how vendor calls device, using some names from stock dmesg:

grep "PM8909 SMB1360 1GB MTP"
arch/arm/boot/dts/pixi35/msm8909-mtp-smb1360.dts:       model = "Qualcomm Technologies, Inc. MSM8909-PM8909 SMB1360 1GB MTP";
arch/arm/boot/dts/pixi355/msm8909-mtp-smb1360.dts:      model = "Qualcomm Technologies, Inc. MSM8909-PM8909 SMB1360 1GB MTP";
arch/arm/boot/dts/pixi37/msm8909-mtp-smb1360.dts:       model = "Qualcomm Technologies, Inc. MSM8909-PM8909 SMB1360 1GB MTP";
arch/arm/boot/dts/pixi384g/msm8909-mtp-smb1360.dts:     model = "Qualcomm Technologies, Inc. MSM8909-PM8909 SMB1360 1GB MTP";
arch/arm/boot/dts/pixi445_tf/msm8909-mtp-smb1360.dts:   model = "Qualcomm Technologies, Inc. MSM8909-PM8909 SMB1360 1GB MTP";
arch/arm/boot/dts/qcom/msm8909-mtp-smb1360.dts: model = "Qualcomm Technologies, Inc. MSM8909-PM8909 SMB1360 1GB MTP";

grep "HX8379C TDT fwvga video"
arch/arm/boot/dts/pixi35/dsi-panel-hx8379c-tdt-fwvga-video.dtsi:                qcom,mdss-dsi-panel-name = "HX8379C TDT fwvga video mode dsi panel";
arch/arm/boot/dts/pixi355/dsi-panel-hx8379c-tdt-fwvga-video.dtsi:               qcom,mdss-dsi-panel-name = "HX8379C TDT fwvga video mode dsi panel";
arch/arm/boot/dts/pixi37/dsi-panel-hx8379c-tdt-fwvga-video.dtsi:                qcom,mdss-dsi-panel-name = "HX8379C TDT fwvga video mode dsi panel";
arch/arm/boot/dts/pixi384g/dsi-panel-hx8379c-tdt-fwvga-video.dtsi:              qcom,mdss-dsi-panel-name = "HX8379C TDT fwvga video mode dsi panel";
arch/arm/boot/dts/pixi445_tf/dsi-panel-hx8379c-tdt-fwvga-video.dtsi:            qcom,mdss-dsi-panel-name = "HX8379C TDT fwvga video mode dsi panel";

grep "TLi020A1-1956265-2000mAh"
arch/arm/boot/dts/pixi35/TCL_TLi020A1_1956265_2000mAh_3p4COV_VBMS_Final-0729.dtsi: qcom,TCL-TLi020A1-1956265-2000mAh-VBMS-data {
arch/arm/boot/dts/pixi35/TCL_TLi020A1_1956265_2000mAh_3p4COV_VBMS_Final-0729.dtsi:      qcom,battery-type = "TLi020A1-1956265-2000mAh";

grep -sni board-id arch/arm/boot/dts/pixi35/msm8909*.dts
arch/arm/boot/dts/pixi35/msm8909-1gb-cdp.dts:22:        qcom,board-id= <1 0>;
arch/arm/boot/dts/pixi35/msm8909-1gb-mtp.dts:22:        qcom,board-id= <8 0>;
arch/arm/boot/dts/pixi35/msm8909-1gb-qrd-skua.dts:20:   qcom,board-id= <0x1000b 0>;
arch/arm/boot/dts/pixi35/msm8909-1gb-qrd-skuc.dts:18:   qcom,board-id= <0x1000b 0x8>, <0x11000b 0x8>, <0x21000b 0x8>;
arch/arm/boot/dts/pixi35/msm8909-1gb-qrd-skue.dts:18:   qcom,board-id= <0x1000b 0x9>;
arch/arm/boot/dts/pixi35/msm8909-1gb-rcm.dts:23:        qcom,board-id= <21 0x0>;
arch/arm/boot/dts/pixi35/msm8909-512mb-mtp-smb1360.dts:25:      qcom,board-id= <8 0x103>;
arch/arm/boot/dts/pixi35/msm8909-cdp.dts:23:    qcom,board-id= <1 0x100>;
arch/arm/boot/dts/pixi35/msm8909-mtp.dts:23:    qcom,board-id= <8 0x100>;
arch/arm/boot/dts/pixi35/msm8909-mtp-smb1360.dts:24:    qcom,board-id= <8 0x3>;
arch/arm/boot/dts/pixi35/msm8909-pm8916-1gb-qhd-rcm.dts:23:     qcom,board-id= <21 0x1001>;
arch/arm/boot/dts/pixi35/msm8909-pm8916-1gb-rcm.dts:22: qcom,board-id= <21 0x1>;
arch/arm/boot/dts/pixi35/msm8909-pm8916-cdp.dts:24:     qcom,board-id= <1 0x2>;
arch/arm/boot/dts/pixi35/msm8909-pm8916-mtp.dts:23:     qcom,board-id= <8 0x2>;
arch/arm/boot/dts/pixi35/msm8909-pm8916-mtp-smb1360.dts:23:     qcom,board-id= <8 0x4>;
arch/arm/boot/dts/pixi35/msm8909-pm8916-qhd-rcm.dts:24: qcom,board-id= <21 0x1101>;
arch/arm/boot/dts/pixi35/msm8909-qhd-cdp.dts:25:        qcom,board-id= <1 0x1100>;
arch/arm/boot/dts/pixi35/msm8909-qhd-rcm.dts:25:        qcom,board-id= <21 0x1100>;
arch/arm/boot/dts/pixi35/msm8909-qrd-skua.dts:19:       qcom,board-id= <0x1000b 0x100>;
arch/arm/boot/dts/pixi35/msm8909-qrd-skuc.dts:19:       qcom,board-id= <0x1000b 0x108>, <0x11000b 0x108>, <0x21000b 0x108>;
arch/arm/boot/dts/pixi35/msm8909-qrd-skue.dts:19:       qcom,board-id= <0x1000b 0x109>;
arch/arm/boot/dts/pixi35/msm8909-rumi.dts:22:   qcom,board-id= <15 0>;
arch/arm/boot/dts/pixi35/msm8909-sim.dts:22:    qcom,board-id= <16 0>;

It seems Pop3 (5) name in vendor kernel sources is pixi35. This 3 seems to be our targets:

arch/arm/boot/dts/pixi35/msm8909-1gb-mtp.dts:22:        qcom,board-id= <8 0>;
arch/arm/boot/dts/pixi35/msm8909-mtp.dts:23:            qcom,board-id= <8 0x100>;
arch/arm/boot/dts/pixi35/msm8909-mtp-smb1360.dts:24:    qcom,board-id= <8 0x3>;

Bootloader

It is usual for qcom LK but with disabled fastboot mode.
Stock firmware 01002 contain Developer options->Enable OEM unlock switch, but
it has no visible effect.
4PDA recomends suspicious KingRoot v.4.0.0.233 app.
It realy installs su somehow, but also place alot of strange files into
all places of system including read-only recovery areas.

Need to check iovyroot or rowhammer exploits, maybe it is possible to use them.
UPDATE: iovyroot works fine on build 01002

Splash screen

Splash screen lives in /dev/block/bootdevice/by-name/splash partition.
Probably it is same as other qcom devices: bitmap of size 480x854, vertically rotated and 24bit RGB888
Konstat have info how to cook it for same msm8909 device here http://konstakang.com/devices/y560/stock-splash/

Input devices

cm-12.1 data

shell@pop35:/ $ getevent -p
add device 1: /dev/input/event8
  name:     "msm8909-snd-card Headset Jack"
  events:
    SW  (0005): 0002  0004  0006  000e  000f  0010 
  input props:
    <none>
add device 2: /dev/input/event7
  name:     "msm8909-snd-card Button Jack"
  events:
    KEY (0001): 0072  0073  00e2  0104  0246 
  input props:
    <none>
add device 3: /dev/input/event5
  name:     "qpnp_pon"
  events:
    KEY (0001): 0072  0074 
  input props:
    0004
add device 4: /dev/input/event2
  name:     "tsl27723-als"
  events:
    ABS (0003): 0028  : value 0, min 0, max 65535, fuzz 0, flat 0, resolution 0
  input props:
    <none>
add device 5: /dev/input/event1
  name:     "tsl27723-ps"
  events:
    ABS (0003): 0019  : value 0, min 0, max 1, fuzz 0, flat 0, resolution 0
  input props:
    <none>
could not get driver version for /dev/input/mice, Not a typewriter
add device 6: /dev/input/event0
  name:     "ft5x06_ts"
  events:
    KEY (0001): 0074  014a 
    ABS (0003): 002f  : value 0, min 0, max 1, fuzz 0, flat 0, resolution 0
                0035  : value 0, min 0, max 480, fuzz 0, flat 0, resolution 0
                0036  : value 0, min 0, max 854, fuzz 0, flat 0, resolution 0
                0039  : value 0, min 0, max 65535, fuzz 0, flat 0, resolution 0
  input props:
    INPUT_PROP_DIRECT
add device 7: /dev/input/event6
  name:     "gpio-keys"
  events:
    KEY (0001): 0073 
  input props:
    <none>
add device 8: /dev/input/event4
  name:     "bma_interrupt"
  events:
    REL (0002): 0001  0002  0006  0007  0008  0009 
    ABS (0003): 0018  : value 0, min 0, max 0, fuzz 0, flat 0, resolution 0
                0019  : value 0, min 0, max 0, fuzz 0, flat 0, resolution 0
  input props:
    <none>
add device 9: /dev/input/event3
  name:     "bma2x2-accel"
  events:
    ABS (0003): 0000  : value 96, min -512, max 512, fuzz 0, flat 0, resolution 0
                0001  : value 16, min -512, max 512, fuzz 0, flat 0, resolution 0
                0002  : value 1008, min -512, max 512, fuzz 0, flat 0, resolution 0
                0028  : value 0, min 0, max 0, fuzz 0, flat 0, resolution 0
  input props:
    <none>

---